CVE-2026-101142

Executive Summary

CVE-2026-101142 is a path traversal vulnerability (CWE-22) affecting Eleveo Quality Management version 9.7.0, specifically within the Questionnaire Audio Upload component and its handling of the file Scorecard.jsp. An authenticated remote attacker can manipulate input to traverse the filesystem outside the intended upload directory, resulting in low-confidentiality, low-integrity, and low-availability impact as reflected in the CVSS 3.1 base score of 6.3. The exploit has been publicly disclosed and the vendor has not responded to early notification, leaving all deployments of version 9.7.0 exposed with no available patch.

Technical Analysis

Eleveo Quality Management is an enterprise contact-center quality monitoring and workforce optimization platform. The vulnerability resides in the Questionnaire Audio Upload component, which is accessed through the web-accessible file Scorecard.jsp. Path traversal (CWE-22) arises when an application constructs a filesystem path using externally supplied input without adequately neutralizing traversal sequences such as ../ or encoded equivalents (%2e%2e%2f, ..%5c, and similar). When the application fails to canonicalize the resulting path and validate it against an expected base directory, an attacker can cause the server to read from or write to locations outside the intended storage directory.

The NVD description states that "an unknown functionality of the file Scorecard.jsp of the component Questionnaire Audio Upload" is affected and that "the manipulation leads to path traversal." The precise request parameter involved is not disclosed in the available intelligence; therefore, the attack must be characterized at the vulnerability-class level rather than by inventing specific parameter names. What is technically derivable is the following:

1. Attack surface: The Scorecard.jsp endpoint is reachable over the network (CVSS AV:N), confirming the component is exposed via the web interface of Quality Management. The audio-upload workflow implies the application accepts file submissions and stores them server-side, and it is this path construction for stored audio that is vulnerable.
2. Privilege requirement: The CVSS vector specifies PR:L (Low privileges), meaning authentication as a low-privileged user is required to reach the vulnerable functionality. This is consistent with the upload feature being available to standard, non-administrative platform users.
3. Mechanism: Because the flaw class is CWE-22, the exploit involves submitting crafted path content (directory traversal sequences, potentially URL-encoded or double-encoded) that the application passes into a filesystem operation without sanitization. Depending on whether the vulnerable sink is a read or write operation, the outcome is arbitrary file read or arbitrary file write outside the designated upload folder.
4. Complexity: AC:L (Low) indicates no special preconditions, race conditions, or unusual target configuration are needed; a single crafted request triggers the flaw.

No public technical write-up, exploit code, Nuclei template, or reproduction detail was provided in the source data. The technical description here is therefore bounded by the vulnerability class and the NVD narrative; no function names, class names, additional parameters, or internal file paths beyond Scorecard.jsp are asserted, because none are present in the source intelligence.

Exploitation Scenarios

No public PoC is available in the provided dataset; the attack chain below is inferred strictly from the vulnerability class (CWE-22) and the disclosed facts, without fabricating implementation specifics.

1. Reconnaissance / target identification. An attacker identifies internet- or intranet-exposed Eleveo Quality Management 9.7.0 instances. Fingerprinting relies on the web interface associated with Scorecard.jsp and other platform pages; Shodan or similar engines can locate hosts running the product. The attacker obtains credentials for a low-privileged account (e.g., through phishing, credential reuse, or a purchased credential set), consistent with the PR:L vector.

2. Triggering the flaw. The attacker navigates to the Questionnaire Audio Upload functionality served by Scorecard.jsp and supplies a crafted path value through the upload request. Per CWE-22 mechanics, traversal sequences — plain, URL-encoded, or double-encoded — are embedded in the path input in an attempt to escape the intended upload/storage directory. Because the description confirms remote initiation with low complexity, a single authenticated request is sufficient to exercise the vulnerable path construction.

3. Payload / execution method (vulnerability-class level). Depending on whether the vulnerable sink performs a read or a write, the effect is arbitrary file read (e.g., retrieving configuration files or credential stores reachable by the web service account) or arbitrary file write (e.g., placing a file outside the upload directory, potentially into a web-served path if the deployment permits). No specific exploitation payload, endpoint beyond Scorecard.jsp, or function name can be stated because the source data does not disclose them.

4. Post-exploitation impact. Successful traversal yields low-severity confidentiality, integrity, and availability effects (C:L/I:L/A:L). Confidentiality loss stems from reading files the attacker should not access; integrity loss from writing or overwriting files; availability loss from disrupting or corrupting files the application depends on. A path traversal of this nature is frequently chained with further attacks — for example, reading secrets to escalate access or writing a file to achieve code execution if the deployment allows — but any such chaining is speculative and not confirmed by the provided intelligence.

The exploit is publicly disclosed and "may be used" per the NVD narrative, indicating a real, if currently low-complexity and moderate-impact, exposure. The absence of CISA KEV listing and the lack of a public exploit artifact in this dataset temper the assessed immediacy of widespread exploitation.

Impact Assessment

Business impact centers on the integrity and confidentiality of the Quality Management platform's server-side data. Because Eleveo Quality Management stores contact-center recordings, scorecards, and questionnaire audio — data that can contain regulated PII and customer interactions — a traversal flaw that permits reading files outside the upload directory could expose sensitive configuration or stored data to an authenticated adversary. The CVSS 3.1 base score of 6.3 reflects a medium-severity profile: network-reachable (AV:N), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and limited confidentiality, integrity, and availability impact (C:L/I:L/A:L).

The blast radius is any Eleveo Quality Management 9.7.0 deployment that exposes the Quality Management web interface and allows the low-privileged Questionnaire Audio Upload workflow. Because no patch exists and the vendor did not respond, every affected instance remains exposed until mitigating controls are applied. The scope is unchanged (S:U), meaning the impact is confined to the security authority of the vulnerable component rather than crossing into other trust domains. Organizations should weigh the medium score against the sensitive nature of contact-center data and the potential for chaining the traversal with other weaknesses to amplify impact beyond the scored baseline.

Detection Guidance

Sigma Rule

title: Eleveo Quality Management Scorecard.jsp Path Traversal Attempt
id: 8f2c1a54-6b7e-4d9a-9c3e-1a2b3c4d5e6f
status: experimental
description: Detects HTTP requests to Scorecard.jsp containing directory traversal sequences targeting the CVE-2026-101142 path traversal flaw in Eleveo Quality Management.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101142
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|endswith: '/Scorecard.jsp'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%2F'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%5c'
      - '%252e%252e%252f'
      - '....//'
  condition: selection_uri and selection_traversal
fields:
  - c-ip
  - cs-uri-stem
  - cs-uri-query
  - cs-username
  - sc-status
falsepositives:
  - Legitimate applications passing relative paths in the query string
level: high
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.101142

YARA Rule

rule CVE_2026_101142_Eleveo_PathTraversal
{
    meta:
        description = "Detects path traversal payloads targeting Eleveo Quality Management Scorecard.jsp (CVE-2026-101142)"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-101142"
        cve = "CVE-2026-101142"

    strings:
        $jsp = "Scorecard.jsp" ascii nocase
        $trav1 = "../" ascii
        $trav2 = "..%2f" ascii nocase
        $trav3 = "%2e%2e%2f" ascii nocase
        $trav4 = "..%5c" ascii nocase
        $trav5 = "%252e%252e%252f" ascii nocase
        $trav6 = "....//" ascii

    condition:
        $jsp and any of ($trav*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101142 Eleveo Quality Management Scorecard.jsp Path Traversal Attempt"; flow:established,to_server; http.uri; content:"Scorecard.jsp"; nocase; http.uri; content:"../"; distance:0; nocase; sid:2026101142; rev:1; reference:cve,2026-101142; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-101142; classtype:web-application-attack; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

alert http any any -> any any (msg:"CVE-2026-101142 Eleveo Quality Management Encoded Path Traversal Attempt"; flow:established,to_server; http.uri; content:"Scorecard.jsp"; nocase; http.uri; content:"%2e%2e%2f"; nocase; sid:2026101143; rev:1; reference:cve,2026-101142; classtype:web-application-attack; metadata:created_at 2026_01_01;)

Elastic Detection

network where url.path : "*/Scorecard.jsp*" and
  (url.query : "*../*" or
   url.query : "*..%2f*" or
   url.query : "*..%2F*" or
   url.query : "*%2e%2e%2f*" or
   url.query : "*%2e%2e/*" or
   url.query : "*..%5c*" or
   url.query : "*%252e%252e%252f*")

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, cs_uri_stem, url, request)
| eval qs = coalesce(uri_query, cs_uri_query, url_query)
| where like(uri, "%Scorecard.jsp%") AND (like(qs, "%../%") OR like(qs, "%..%2f%") OR like(qs, "%..%2F%") OR like(qs, "%2e%2e%2f%") OR like(qs, "%..%5c%") OR like(qs, "%252e%252e%252f%") OR like(qs, "%....//%"))
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, qs, host, status
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,eleveo,">
  <rule id="101142" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.jsp</field>
    <regex type="pcre2">Scorecard\.jsp.*(\.\./|\.\.%2f|\.\.%2F|%2e%2e%2f|%2e%2e/|\.\.%5c|%252e%252e%252f|\.\.\.\.//)</regex>
    <description>CVE-2026-101142: Possible path traversal attempt against Eleveo Quality Management Scorecard.jsp</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_101142,attack,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor was contacted but did not respond, and no fixed version, workaround, or advisory has been published. The following guidance is therefore mitigation-oriented and should be treated as interim risk reduction, not remediation.

1) Immediate mitigations (compensating controls, apply now):

• Restrict network access to the Quality Management web interface to trusted management segments or VPN-only (prefer restriction to known management networks); do not expose Scorecard.jsp directly to the internet.
• Enforce least privilege on application accounts and limit who holds even low-privileged accounts, since the flaw requires authenticated access (PR:L). Disable or restrict the Questionnaire Audio Upload capability for users who do not require it.
• Deploy WAF/IDS rules matching the detection signatures above, specifically blocking requests to Scorecard.jsp whose query string contains traversal sequences (including encoded variants).
• Run the web service account with minimal filesystem permissions, confined to its upload directory, to reduce the impact of a successful read or write outside the intended path.
• Monitor and log all requests to Scorecard.jsp with full query strings for retrospective analysis.

2) Patch/upgrade steps:

• No vendor patch is currently available. Contact Eleveo directly and reference CVE-2026-101142 to request a fix and a status update; monitor the Eleveo advisory channel for a fixed build.
• Do not assume a version upgrade resolves the issue until the vendor confirms the fix for the specific affected functionality in Scorecard.jsp.
• Once a fixed version is released, test in a staging environment before applying to production, and verify the traversal is neutralized after upgrade.

3) Long-term hardening:

• Require input canonicalization and allow-listing for all file-path handling: resolve supplied paths to an absolute canonical form and verify they remain within the intended base directory before any filesystem operation.
• Adopt secure file-upload design patterns that never derive stored paths from user-supplied path segments; use server-generated identifiers instead.
• Institute a vulnerability-management process that tracks vendor responsiveness, given this vendor's non-response, and consider contractual SLAs for security disclosure handling.
• Segment contact-center platforms from general corporate networks and treat stored recordings as sensitive data subject to data-protection controls.
• Maintain ongoing network monitoring for traversal patterns against this and similar JSP upload endpoints until a patch is confirmed.

References

• NVD — CVE-2026-101142: https://nvd.nist.gov/vuln/detail/CVE-2026-101142
• CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): https://cwe.mitre.org/data/definitions/22.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS — CVE-2026-101142 (not yet scored as of this report): https://api.first.org/data/v1/epss?cve=CVE-2026-101142
• Vendor: Eleveo Quality Management (no published advisory identified; vendor contacted, no response): https://www.eleveo.com

No threat actor campaign, exploit-in-the-wild telemetry, or CISA KEV listing is associated with CVE-2026-101142 in the provided intelligence.